feat(settings): surface push.ntfyUrl in /public/settings for the app

The Android app's embedded push distributor (M7 Part 2) needs the shard's
client-facing ntfy relay URL to build its device topic endpoint, but the M7
Part 1 backend only used the NTFY_* vars server-side and never surfaced them.

Add a `push: { ntfyUrl }` block to settings.getPublic(), sourced from
NTFY_PUBLIC_URL or the first NTFY_ALLOWED_ORIGINS entry (never the possibly
internal NTFY_BASE_URL); null when unconfigured, so the app shows push as
unavailable for that shard. Additive, non-sensitive, forward-compatible.

- Extend the PublicSettings swagger schema; regenerate swagger-output.json.
- publicBrand.test.js: cover null / NTFY_PUBLIC_URL / NTFY_ALLOWED_ORIGINS.
- Document NTFY_PUBLIC_URL in .env.example and (docs PR) BACKEND_DESIGN.md.

Full server suite green (250 pass).

Co-Authored-By: Claude <noreply@anthropic.com>

server/swagger/swagger.js

@@ -680,6 +680,14 @@ const doc = {
           },
           gameAccountSignup: { type: 'boolean', example: false },
           brand: { $ref: '#/components/schemas/Brand' },
+          push: {
+            type: 'object',
+            description:
+              'Push-notification relay config (M7). `ntfyUrl` is the client-facing ntfy base URL the app registers its device topic against (from NTFY_PUBLIC_URL / NTFY_ALLOWED_ORIGINS); null when push is not configured for this shard.',
+            properties: {
+              ntfyUrl: { type: 'string', nullable: true, example: 'https://ntfy.example.com' },
+            },
+          },
         },
         additionalProperties: true,
       },